The interpreter engine for the core JavaScript language, independent of the browser's object model. File ONLY core JavaScript language bugs in this category. For bugs involving browser objects such as "window" and "document", use the "DOM" component. For bugs involving calls between JavaScript and C++, use the "XPConnect" component.

This issue can be reproduce with --ion-eager.
gczeal(4);
for (var i = 0; i < 0;)
;
We hit a typebarrier when we read "i" and bailout to a point where we can start a new compilation cycle without any updated type information.
I made a work around which check that the bailout does not return to an OSR point and skip the next compilation if this is the case.

Created attachment 620539[details][diff][review]
Skip next OSR if a GC remove the forbidOSR just after the bailout.
Skip all JSOP_GOTO and the next JSOP_LOOPENTRY to avoid the first OSR after a bailout.